جزئیات آسیب‌پذیری

خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

• http://www.securityfocus.com/archive/1/534689/100/0/threaded mailing-listx_refsource_BUGTRAQ
• http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html x_refsource_MISC
• https://access.redhat.com/errata/RHSA-2017:0868 vendor-advisoryx_refsource_REDHAT
• http://www.securityfocus.com/bid/72585 vdb-entryx_refsource_BID
• http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/ x_refsource_CONFIRM
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100850 vdb-entryx_refsource_XF
• http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html x_refsource_MISC
• https://www.elastic.co/community/security/ x_refsource_CONFIRM
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1427 government-resource